The Model Context Protocol published its 2026-07-28 specification on July 28, marking the largest revision since the protocol launched. The headline change: MCP is now stateless. Sessions are gone. Authorization moved from implicit server-side context to explicit per-request credentials. A governed extensions system replaced ad-hoc capability negotiation.
This matters because the old design leaked trust across tool boundaries. A stateful MCP server held session context for multiple tool calls, which meant a compromised tool could poison the session for subsequent calls. The new spec forces every tool invocation to carry its own proof of authorization, shifting the security boundary from the server to the protocol itself.
AWS shipped support in AgentCore Gateway the same day via a single UpdateGateway API call. Here’s what changed under the hood and how it affects agent orchestration.
What Stateless MCP Actually Means
The original MCP design used persistent sessions. When an agent connected to an MCP server, the server allocated a session object that tracked:
- Authentication state (who is calling)
- Authorization grants (what they can do)
- Conversation context (what they’ve done)
- Tool availability (what’s currently enabled)
Every subsequent tool call referenced that session. The server looked up the session ID, checked permissions, and executed the tool. This worked fine for single-agent, single-user scenarios. It broke down when multiple agents shared a server, when tools needed to delegate to other tools, or when you wanted to replay a tool call in a different security context.
The 2026-07-28 spec removes sessions entirely. Each tool call is now a self-contained request that includes:
- A signed credential token (not a session reference)
- The full authorization scope for this specific call
- Any context required to execute the tool (no server-side memory)
The server validates the token, checks the scope, executes the tool, and forgets everything. No session state persists between calls.
Authorization Model: From Ambient to Explicit
The old model relied on ambient authority. Once you authenticated to an MCP server, you inherited a set of permissions for the duration of the session. If you called read_file, the server checked “does this session have file read access?” If yes, it executed. If no, it rejected.
The new model uses capability tokens. Each tool call carries a token that explicitly grants permission for that specific operation. The token might say:
{
"tool": "read_file",
"scope": "s3://my-bucket/agents/context/*",
"expires": "2026-07-28T20:00:00Z",
"signature": "..."
}The server validates the signature, checks the scope matches the requested path, verifies the expiration, and executes. If the agent tries to read a file outside the scope, the call fails even if the token is valid.
This shifts the trust boundary. In the old model, you trusted the server to enforce permissions. In the new model, you trust the token issuer (usually an orchestration layer like AgentCore Gateway) to mint tokens with the correct scope. The server becomes a stateless executor that only validates tokens.
Governed Extensions: Capability Registry or Runtime Sandbox?
The spec introduces a “governed extensions system” without defining the implementation. AWS’s AgentCore Gateway interprets this as a capability registry backed by IAM policies.
When you enable an MCP extension (a new tool, a data source, a custom protocol feature), you register it with the gateway. The registration includes:
- The extension identifier (a URI like
mcp://tools/custom-search) - The IAM role required to invoke it
- The resource scope it can access (S3 prefixes, DynamoDB tables, etc.)
- Rate limits and quota policies
When an agent requests a tool call, the gateway checks the registry, mints a capability token with the appropriate scope, and forwards the request to the MCP server. The server validates the token and executes.
This is not a runtime sandbox. The MCP server still runs arbitrary code. The governance happens at the policy layer, not the execution layer. If you need sandboxing (isolating tool execution in a container, limiting syscalls, etc.), you build that into the server itself or run each tool in a separate Lambda function.
State Reconstruction Without Sessions
Stateless doesn’t mean context-free. Agents still need to pass context between tool calls. The spec solves this by requiring the client (the agent orchestrator) to manage state.
In practice, this looks like:
- Agent calls
search_documentswith a query - MCP server returns a result set with a continuation token
- Agent stores the token in its local state
- Agent calls
read_documentwith the token and a document ID - MCP server validates the token, retrieves the document, returns it
The server never stores the result set. The continuation token is a signed blob that contains everything the server needs to reconstruct the result set (the query, the offset, the expiration). The agent is responsible for passing it back.
This pattern appears in every stateless protocol (HTTP, gRPC, etc.). The novelty here is applying it to agent tool calls, where the context can be large (megabytes of conversation history, hundreds of tool results) and the security implications are higher (a leaked continuation token might grant access to sensitive data).
Security Vulnerabilities the New Spec Closes
The old stateful design exposed three main attack vectors:
Session Fixation
An attacker could predict or steal a session ID, then inject malicious tool calls into an active session. If the server didn’t validate the caller on every request, the attacker inherited the session’s permissions.
The stateless model eliminates this. There’s no session to fixate. Every call requires a fresh capability token.
Privilege Escalation via Tool Chaining
In the old model, if Tool A had permission to call Tool B, and Tool B had permission to call Tool C, then Tool A could indirectly access Tool C by chaining calls. The server saw all calls as coming from the same session.
The new model requires each tool call to carry its own token. Tool A can’t mint a token for Tool C unless the orchestrator explicitly grants that capability. The server validates every token independently.
Context Poisoning
A compromised tool could modify the session state (conversation history, authorization grants, etc.) to influence subsequent tool calls. The server had no way to detect tampering because the state was mutable.
The new model makes context immutable from the server’s perspective. The agent passes context as signed tokens. The server validates the signature but never modifies the token. If a tool wants to update context, it returns a new token to the agent, which the agent stores and passes on the next call.
AgentCore Gateway Implementation
AWS’s implementation treats the gateway as a credential broker. When an agent requests a tool call:
- Gateway receives the request with the agent’s IAM identity
- Gateway looks up the tool in the capability registry
- Gateway checks if the IAM identity has permission to invoke the tool
- Gateway mints a capability token scoped to this specific call
- Gateway forwards the request to the MCP server with the token
- MCP server validates the token and executes
- Gateway logs the call for audit
The gateway doesn’t execute tools. It doesn’t store session state. It’s a policy enforcement point that translates IAM permissions into MCP capability tokens.
Enabling the new spec is a single API call:
import boto3
client = boto3.client('bedrock-agent')
response = client.update_gateway(
gatewayId='gw-abc123',
mcpSpecVersion='2026-07-28',
extensionGovernance={
'enabled': True,
'registryArn': 'arn:aws:bedrock:us-east-1:123456789012:capability-registry/prod'
}
)The extensionGovernance parameter points to a capability registry (a DynamoDB table or S3 bucket) that defines which extensions are allowed and what permissions they require.
Trade-offs: Stateless vs. Stateful
| Dimension | Stateless (2026-07-28) | Stateful (Pre-2026-07-28) |
|---|---|---|
| Security boundary | Per-request capability tokens | Per-session ambient authority |
| Context management | Client-side (agent stores state) | Server-side (server stores state) |
| Horizontal scaling | Trivial (no shared state) | Requires sticky sessions or shared store |
| Replay attacks | Mitigated by token expiration | Vulnerable if session IDs leak |
| Tool chaining | Explicit delegation required | Implicit via session inheritance |
| Audit trail | Every call is independently logged | Session-level logging only |
| Latency | +10-20ms per call (token validation) | Faster (session lookup is cached) |
| Complexity | Higher (client manages state) | Lower (server manages state) |
The latency hit is real. Every call now requires cryptographic signature validation. AWS reports 10-20ms overhead per tool call on AgentCore Gateway. For high-frequency agents (hundreds of tool calls per second), this adds up.
The complexity shift is also real. Agent orchestrators now need to track continuation tokens, manage token expiration, and handle token refresh. This was previously hidden inside the MCP server.
When to Upgrade
Upgrade to MCP 2026-07-28 if:
- You run multi-tenant agent systems where isolation matters
- You need to replay or audit individual tool calls
- You want to scale MCP servers horizontally without sticky sessions
- You’re building agents that delegate to other agents (tool chaining)
Stay on the old spec if:
- You have a single-agent, single-user system with no isolation requirements
- You can’t tolerate the 10-20ms latency overhead
- Your orchestrator doesn’t have the complexity budget to manage client-side state
- You’re using MCP servers that haven’t implemented the new spec yet
The spec is backward-compatible. Old clients can still connect to new servers (the server falls back to stateful mode). New clients can’t connect to old servers (they require capability tokens).
Technical Verdict
The shift to stateless MCP is a security win at the cost of orchestration complexity. The new model closes real vulnerabilities (session fixation, privilege escalation, context poisoning) by moving trust from the server to the protocol. The trade-off is that every agent orchestrator now needs to manage state, validate tokens, and handle expiration.
Use the new spec if you’re building production agent systems with multiple tenants or complex tool chains. The security boundary is clearer, the audit trail is better, and horizontal scaling is trivial. Accept the latency overhead and the orchestrator complexity.
Avoid the new spec if you’re prototyping, running single-user agents, or working with MCP servers that haven’t upgraded yet. The old stateful model is simpler and faster for low-security scenarios.
AWS’s AgentCore Gateway makes the upgrade trivial (one API call), but you still need to update your agent orchestrator to manage client-side state. Budget a week to refactor your state management layer.